AI notetakers spread through small businesses the way most software does now: one person connected one to a calendar, and soon a bot was showing up to every call with a customer, a candidate, or a lender. Few owners asked whether anyone on the other end agreed to be recorded, or what the vendor does with the recording afterward.

A federal court in San Jose has started answering both questions. On August 13, 2026, Judge Eumi K. Lee issued an order granting in part and denying in part Otter.ai's motion to dismiss in In re Otter.AI Privacy Litigation, No. 5:25-cv-06911 (N.D. Cal.). The federal wiretap claim, the California eavesdropping claim, and the Illinois biometric claims survived. Otter filed its answer on September 17, 2026, denying the plaintiffs' core allegations. Nothing has been proven, and no court has found Otter liable.

The case is against the vendor. The consent rules it applies, though, are the same ones that govern you when you invite the bot.

What the plaintiffs say happened

The plaintiffs are seven people from California, Illinois, and Washington who were on Zoom, Microsoft Teams, or Google Meet calls where someone else had deployed the Otter Notetaker. They allege the bot joined as a “silent participant,” recorded and transcribed in real time without the consent of all participants, and kept the conversations, along with voiceprints, to train Otter's speech-recognition and machine-learning models. One plaintiff was talking with a medical provider. Others were discussing finances or work matters.

Those are allegations. Otter denies them, and the court took them as true only because that is the rule at the motion-to-dismiss stage.

What the court decided, claim by claim

Federal Wiretap Act: survived. Federal law is a one-party-consent regime. Under 18 U.S.C. § 2511(2)(d), it isn't unlawful to intercept a communication you are a party to, or that one party consented to, “unless such communication is intercepted for the purpose of committing any criminal or tortious act.” Otter argued it was a party, or at least had its user's consent. The court held the plaintiffs had plausibly alleged a tortious purpose: using conversation data to train models “for its own pecuniary gain.” In the court's words, quoting an earlier case, “committing a tort and seeking a profit are not mutually exclusive.”

California Invasion of Privacy Act, § 631: survived. Section 631 targets third-party eavesdroppers. A software vendor that acts only as “an extension” of its customer, recording the customer's own calls for the customer's use, generally isn't a third party. But the court held that a vendor that “independently collects, retains, and uses communications for its own commercial purposes” can be one. That distinction matters most for the businesses using these tools: a notetaker that keeps your call data for its own model training looks less like your tape recorder and more like an outside listener.

California § 632: mixed. Section 632 bars recording a “confidential communication” without the consent of all parties. The plaintiff who described a medical conversation alleged enough. Two plaintiffs who called their conversations “private” or “sensitive” without saying more did not, at least in the current complaint.

Illinois BIPA: survived. The Biometric Information Privacy Act lists voiceprints as biometric identifiers and requires written notice and a written release before a private entity collects them. The plaintiffs alleged the notetaker captured voiceprints without either, and that was enough to proceed.

Dismissed, with leave to amend: among others, the federal computer fraud claim, the California computer-access claim, some plaintiffs' intrusion claims, and a Washington privacy claim. The Washington claim failed because the plaintiff didn't allege enough about why his conversation was private. On consent, though, the court sided with him. Even if the bot “appeared in the meeting as another participant,” the court could not infer that he knew his words were being recorded, transcribed, and retained.

That last point should change how you think about the little bot tile in the participant list. A visible attendee named “Notetaker” is not the same as informed consent.

The case is in discovery. Under the amended scheduling order, the deadline to move for class certification is May 13, 2027.

Why this is your problem, not just Otter's

California's eavesdropping statute applies to the person doing the recording, not just to vendors. The text of Penal Code § 632(a) (as amended in 2016) reaches anyone who, “intentionally and without the consent of all parties to a confidential communication,” uses a recording device to record it. “Person” expressly includes a business entity. A “confidential communication” is one “carried on in circumstances as may reasonably indicate that any party to the communication desires it to be confined to the parties thereto.”

A call with a customer about their finances, a negotiation with a buyer, or an interview with a job candidate will often fit that definition.

The civil remedy is the reason plaintiffs' lawyers care. Penal Code § 637.2(a) allows a civil action for the greater of $5,000 per violation or three times actual damages. California's SB 690, signed September 30, 2026 (Statutes of 2026, ch. 976), limits private suits over pen-register and trap-and-trace claims arising from websites and apps to the Attorney General. It doesn't touch §§ 631 or 632 claims over recorded conversations.

California is not alone. Other states that require every party's consent include:

Other states have their own rules, and some impose all-party requirements with different scope. Because you usually can't tell where every participant is sitting, the practical approach is to run every call as if the strictest rule applies.

A meeting protocol that holds up

Consider a 25-person financial planning firm with clients in California, Washington, and Arizona. Advisors use an AI notetaker on most client calls. Here is a protocol that fits most businesses with that profile.

1. Announce the recording at the start, out loud, every time. “Before we begin, I use an AI notetaker that records and transcribes this call. Is that all right with you?” Let the recording capture the answer. This tracks Washington's statutory safe harbor and gives you the best evidence of consent everywhere else.

2. Put it in writing before the call. Add a line to the calendar invite and your engagement letter or terms: calls may be recorded and transcribed by an AI service, and the participant can ask you to turn it off. Written notice doesn't replace the spoken announcement. It backs it up.

3. Turn it off when someone says no, and when the topic calls for it. Make “no recording” an easy answer. Some conversations shouldn't be recorded by a third-party service at all, including health information, attorney communications, and personnel investigations. Our piece on whether AI tool conversations are privileged explains why sending a privileged discussion to an outside AI service is a risk on its own.

4. Stop the auto-join. The Otter complaint alleges that once an accountholder connects a calendar, the notetaker automatically joins and records every meeting on it. Otter denies that allegation, but the risk it describes is real for any calendar-connected tool. Configure the tool so it joins only when the host turns it on, and forbid connecting personal notetaker accounts to company calendars in your employee AI use policy.

5. Read the vendor's data terms, then negotiate them. The § 631 ruling turned on the allegation that the vendor used conversation data for its own purposes. Look for model training on customer content, retention periods, de-identification claims, and whether you can opt out at the account level. If the standard terms allow training on your content, ask for an enterprise setting or a contract term that prohibits it. Our AI vendor contract checklist lists the clauses to ask for.

6. Treat voiceprints as biometrics if you touch Illinois. If the tool identifies speakers by voice and any participant may be in Illinois, BIPA's written-notice and written-release requirements are in play. Ask the vendor how speaker identification works and whether it can be disabled.

7. Decide where transcripts live and when they die. A transcript is a business record, discoverable in litigation and subject to privacy laws. Give it a retention period in your data classification policy and stop keeping everything forever by default. The state privacy law overview covers the broader consumer-data obligations.

Frequently asked questions

We're in a one-party-consent state. Are we fine?

Only if everyone on the call is too, and only for your own recording. Calls cross state lines constantly, and the all-party state's law may apply to the participant located there. The federal one-party rule also has the “criminal or tortious purpose” exception the Otter court relied on.

Is the bot showing up in the participant list enough notice?

Don't rely on it. The Otter court refused to infer that a participant knew he was being recorded just because the notetaker appeared as an attendee. An out-loud announcement captured on the recording is much stronger evidence.

Does the Otter ruling mean Otter broke the law?

No. A ruling on a motion to dismiss decides only whether the allegations, assumed true, state a legal claim. Otter has denied the allegations, and the case is in discovery.

This article reflects the August 13, 2026 order and the docket in In re Otter.AI Privacy Litigation, and the cited federal and state statutes, as of October 2026. Recording-consent rules vary by state and by the type of communication. This is general information, not legal advice for your situation.

This article is for educational purposes only and does not constitute legal, tax, or financial advice. Consult a qualified professional for guidance specific to your situation.